The city council wants a statement that ransomware detections are live. What should the analyst do first?
Select an answer to reveal the explanation.
Short Explanation
Installing ES is hanging the smoke detectors; it does not mean batteries and wiring are in every room. Before promising the council, check that the endpoint sourcetypes actually exist and are mapped. Coverage is a data question, not a slide-deck question.
Full Explanation
Claiming a use case is live requires evidence that the prerequisite sourcetypes are present, parsed, and mapped so SSE and ES content can fire. Data-availability views in Security Essentials and data-model completeness in Enterprise Security are the analyst's checks. An installed ES app, enabled-but-empty correlation searches, and tabletop history do not prove telemetry. Do not promise coverage without that verification.